Read-only access
Google Analytics and Search Console connect with Google's read-only permissions: analytics.readonly and webmasters.readonly. SAR gives ChatGPT and Claude only tools that read. None of them can edit products, orders, content or settings.
- WordPress and WooCommerce: SAR allows none of the SAR Commerce Connector plugin's write tools.
- Magento: SAR uses the access token for read tools only.
What each connection can reach
Each connection points to exactly one GA4 property, Search Console site or store, chosen by you.
- Google Analytics: reports, realtime reports, conversions, funnels, property details, custom dimensions and metrics, Google Ads links and property annotations.
- Search Console: queries, clicks, impressions, CTR, position, pages, period comparisons, sitemaps, URL inspection and indexing issues.
- WordPress: published posts and pages with their text, and the site's status, on any WordPress site. It does not read drafts, SEO plugin fields, media, comments, users or settings.
- WooCommerce, through the same connection: products, orders, low stock, sales summary and categories. Orders never include a customer's name, address, email or phone number.
- Magento / Adobe Commerce: orders, invoices, shipments, credit memos, returns, products, inventory, customers, CMS pages, reviews, sales rules and store hierarchy. This is the one source where the AI app can read customer names, emails and order history, and the app warns you before you connect.
What SAR stores, and what it does not
Your conversation history follows ChatGPT's or Claude's own settings. What SAR keeps is listed below.
- Source credentials (passwords and tokens) are encrypted at rest and never shown back to anyone.
- SAR does not record the questions asked or the data returned.
- Failure records are kept for 30 days.
- The most recent 14 backups are kept, replaced nightly.
- Expired OAuth tokens are purged daily.
- The app uses no third-party analytics, advertising or error tracking. Your data is not sold.
Isolation and revoking access
- Each organization is isolated. Its connections and data are never reachable from another organization's connector.
- One AI connector reaches one organization. A second client means a second connector in ChatGPT or Claude.
- Revoke an AI app in the SAR Intelligence app. It takes effect within about a minute.
- Disconnecting a Google source also revokes SAR's Google access.
Account security
- Two-factor authentication and passkeys are available for every account.
- Team roles are Owner, Admin, Analyst and Member.
- The activity log records connections, chosen properties, AI access grants and revokes, role changes and invitations.
Limits you should know about
- ChatGPT or Claude writes the answers, and they can be wrong or incomplete. Check important figures in the source.
- A Magento connection gives the AI app access to customer names, emails and order history.
- SAR Intelligence is in a pilot, without an uptime guarantee.
- The app's privacy policy (https://app.sar-soft.com/privacy) and terms (https://app.sar-soft.com/terms) are drafts pending legal review.